Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "More x86 fixes:

   - Fix a WARN if the SS bit is set in #NPF exit codes.

     The AMD manual is unclear about whether it can be set when the
     guest uses CET but the SupervisorShadowStackEn feature (which KVM
     does not use) is disabled. However, Hyper-V has started using CET
     now that KVM supports GMET (it wants the two feature in pairs), and
     that dissolves all the doubts: the SS bit *is* reported and not
     clearing it causes a WARN and/or a UBSAN splat.

   - If creating a vCPU ultimately fails, clear its entry in the AVIC
     Physical ID table used by hardware to perform IPI Virtualization
     and delivered posted IRQs.

     I.e. plug the same use-after-free hole related to IPI
     virtualization and posted IRQs that was fixed for APICv by commit
     b41f2ca6c0601 ("KVM: VMX: Fix stale PID-pointer table entry left
     after vCPU free").

   - Use set_page_dirty_lock() instead of set_page_dirty() when marking
     a page dirty after writing back SNP firmware's desired CPUID state
     to userspace.

     Using set_page_dirty() is unsafe if the page/folio isn't locked (as
     pointed out by its function comment's big DANGER warning, which no
     one reads given the number of bugs of this exact nature).

   - When checking for an MMIO generation match, use the memslots for
     the current vCPU context (non-SMM vs. SMM), as a misbehaving guest
     can coerce KVM into incorrectly identifying a write as MMIO in
     order to bypass KVM's write-tracking"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
  KVM: x86: Use active memslots for the per-vCPU MMIO cache
  KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
  KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
  KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
  KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable

0 files changed, 0 insertions, 0 deletions